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Issue #114 / The Monthly Journal of the American Hacker / October 2013 


"The fact that we are here today to debate raising America's debt limit is a sign 
of leadership failure. It is a sign that the U.S. government can't pay its own 
bills. It is a sign that we now depend on ongoing financial assistance from 
foreign countries to finance our government's reckless fiscal policies. 


Increasing America's debt weakens us domestically and 

internationally. Leadership means that ‘the buck stops here.’ Instead, 
Washington Is shifting the burden of bad choices today onto the backs of our 
children and grandchildren. 


America has a debt problem and a failure of leadership. Americans deserve 
better.” 


——— Quote from then—Senator Barack Hussein Obama on the increasing the debt 
limit, which he voted against in 2006, as recorded in the Congressional Record for 
the Senate S. 2237-8 March 16, 2006. He never even bothered to vote on the debt 
limit in 2007 or 2008. Change! 


(roc.senate.gov/public/_files/alternativestothedebtlimitincreasev20.pdf) 
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DIRECTORY NUMBER SUBTRANSLATOR 


Oo 


23 18,17 


ABB CODE PLEN 


ABBREVIATED CODE EXPANSION TABLE MHT+47 
23 8) 7,6 0 


* MOBILE BIT 


Fig. 4— Directory Number Translator 
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225-0000 
222-4999 


222-0000 


ZONE 1 DN'S eee 


ZONE 2 DN'S [ 






ZONE 2 GIVES 
MTSO DN'S 
225-4000 -» 225-4999 


ZONE 1 GIVES 
MTSO DN'S 
222-5000 -» 222-5999 


NORMALIZED OFFICE CODE TO 
NUMBER GROUP NUMBER (NOC-NGN) 
TRANSLATOR 


(NGN-NOC ) (NON-NGN ) 





















ae 23, 22) 21, 20, 19) 18) 17, 16, 15) 14, 13) 12) 11, 10, 9, 8| 7 0 (INDEX) 
a nn a, 
of tfofsfofo]sfofofo]sfofofofsfo] now = 127 fa Noci + 04 1 






camer cd CX MD BO cD DD CD CD DD 


NOTE 1: 


NOC 1 IS FOR NXX-222, NGN 1 IS ASSIGNED FOR 222-5XXX, AND NGN 127 
IS CHOSEN ARBITARILY FOR THIS EXAMPLE 


LEGEND: 
DN = DIRECTORY NUMBER 
MTSO = MOBILE TELEPHONE SWITCHING OFFICE 
NGN = NUMBER GROUP NUMBER x 
NOC = NORMALIZED OFFICE CODE 


Fig. 5— Example of Mobile DN Assignment 
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ae LINE EQUIPMENT NUMBER SUBTRANSLATOR 
23 18,17 15) 14, 13 0 





7 ABB CODE 


ABBREVIATED CODE EXPANSION TABLE MHT+46 
23 15; 14) 13 8,7,6 0 


LENCL 1 


i LENCL 2 


LENCL 3 


WORD O 


} 
—_ 
1 
aa 


Lae) 
_ 
* 


* MOBILE BIT 


LEGEND: 
SBN - SPECIAL BILLING NUMBER 


Fig. 6—Line Equipment Number Translator 


Page 47 











AUTOPLEX System 100 Feature Document / #1A ESS - Part 3 


AT&T 231-290-600 





LEGEND: 

ANT - ANTENNA FACE 
CSN - CELL SITE NUMBER (1-255) 

NOTR - NUMBER OF TRUNKS IN GROUP 
SG - SERVER GROUP 

TGTYPE - TRUNK GROUP TYPE=13 FOR ONE-WAY, = 6 FOR 2-WAY 

TNN - TRUNK NETWORK NUMBER 
TIN - TEST TABLE NUMBER 
TU - TRUNK USAGE (SET TO 2 FOR TWO-WAY, SET TO 0 OR 2 FOR ONE-WAY ) 

WRGN - NUMBER OF WORDS IN AUXILIARY BLOCK 


Fig. 7— Trunk Group Number Translator Auxiliary Block 





LEGEND: 
NOTR - NUMBER OF TRUNKS IN GROUP 
TGTYPE - TRUNK GROUP TYPE=2 
TNN - TRUNK NETWORK NUMBER 
TIN - TEST TABLE NUMBER 
TU - TRUNK USAGE (SET TO 2 FOR “AUTOPLEX" SYSTEM 100) 
WRGN - NUMBER OF WORDS IN AUXILIARY BLOCK 


Fig. 8— Trunk Group Number Translator Auxiliary Block for Loop-Around Trunks 
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MEMN - MEMBER NUMBER 
TCC - TRUNK CLASS CODE 
TGN - TRUNK GROUP NUMBER 
TNN - TRUNK NETWORK NUMBER 
WRDFN - WORD FUNCTION 
oe WRDN - NUMBER OF WORDS IN AUXILIARY BLOCK 


Fig. 9— Trunk Network Number to Trunk Group Number Translator Auxiliary Block for 
Loop-Around Trunks 


19 11 


23 20 10; 9 0 


23 | 22) 21 18;17 16 14,13 ;12);11),10) 9 5;,4;,;37;,2;, 1,0 


{T\ 


WORD O 


1 Pap INSEP TGTPRP | TGCRFR TGPMEMN TGMTTY 
wn [OCCCSSd IT 


LEGEND: 

INSEP - INCOMING SEPARATION OF REVENUE CLASS 
TGCRFR - TRUNK GROUP CRAFT FORCE RESPONSIBILITY 
TGMTTY - TRUNK GROUP MAINTENANCE TTY CHANNEL 

TGPMEMN - TRUNK GROUP TEST PANEL MEMBER NUMBER 
TGTPRP - TRUNK GROUP TEST PAD REFERENCE POINT 


Fig. 10— Trunk Group Number Supplementary Table Translator 
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TCC - TRUNK CLASS CODE 
TGN - TRUNK GROUP NUMBER 
VR - VOICE RADIO NUMBER 
VRCHNL - RADIO CHANNEL NUMBER 
VRG - VOICE RADIO GROUP 
WRDN - NUMBER OF WORDS IN AUXILIARY BLOCK 


Fig. 11 Trunk Network Number to Trunk Group Number Translator Auxiliary Block 
for Cell Site Trunks 


23] 22] 21) 20] 19] 18] 17] 16] 15] 14) 13] 12] 11| 10) 9 0 







oe ee ee 
1 be ALL ZEROES > 
TYPE 0 


LEGEND: 
PRI - PSEUDO ROUTE INDEX 
TGN - TRUNK GROUP NUMBER 


Fig. 12—Pseudo Route Index Expansion Tables for PRI 045, 057, 058, 059, 060, and 
061 


TGN 


0 <———_____—_——_- ALL ZEROES ———_-_______®> 





*RS 

LEGEND: 
RI - ROUTE INDEX 
RS - RETURN SUPERVISION 
TGN - TRUNK GROUP NUMBER 


Fig. 13—Route Index Expansion Table for RI 131 
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SELECTOR 


HEAD TABLE 


HTWRDN 


z SUBTRANSLATOR ADDRESS 


126 
MULTIPLY BY 2 
— SUBTRANSLATOR 
23 10; 9, 8,7 0 


SN (BITS 0 TO 23) 


1999 
* EMIN 
LEGEND: 
EMIN - EXTENDED MOBILE IDENTIFICATION NUMBER 
HTWRDON - HEAD TABLE LENGTH 
NGN - NUMBER GROUP NUMBER 
PC - PAGING CHANNELS 
SN - SERIAL NUMBER 


Fig. 14—Directory Number to Serial Number Translator 
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23 0 
° CELL SITE TRUNKING TRANSLATOR 

CELL MASTER STATUS TRANSLATOR 

CELL MASTER EQUIPAGE TRANSLATOR 

CELL MASTER LOCATION TRANSLATOR 


Fig. 15—Cell Site Translator 


FIG. 15 





FIG. 23 





FIG. 25 






FIG. 26 
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SE 


WORD -1/23 
WORD 0O 


255 


CSN 
LECTOR 


2,1, 0 
Pi} fse) a | 


123); 22);21),20 


WORD -1 


Oo 


et 


. 
2 
3 
4 
5 
6 
7 
8 





6 


ISS 3, AT&T 231-290-600 





HEAD TABLE 


AUXILIARY BLOCK ADDRESS 


HEAD TABLE FIXED AT 256 WORDS 


AUXILIARY BLOCK 
18) 17); 16) 15) 14) 13) 12; 11 7,;6),5,4 


RI 


(=) 


Dai XD 
a Mian! 


pe) 
eS 


x 
aa 


TO 96 RADIOS 


UP 
3) 2 0 






LEGEND: 
ANT 
CSN 
CELSTAT 
RI 
SG 


ANTENNA NUMBER TNN - TRUNK NETWORK NUMBER 
CELLSITE NUMBER VR - VOICE RADIO NUMBER 
CELL STATUS BITS VGR - VOICE RADIO GROUP 
ROUTE INDEX WRDN - NUMBER OF WORDS IN 
SERVER GROUP AUXILIARY BLOCK 


Fig. 16—Cell Site Trunking Translator 






(ty 
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AMPS MISCELLANEOUS 
INFORMATION HEAD TABLE 


MHT+73 


18,17 


iar) 
(et) 


WORD -1 


iD 


MISCELLANEOUS AUXILIARY BLOCK 

PAGING CELL SITES AUXILIARY BLOCK 

ROAMER SERVICE LIST AUXILIARY BLOCK (NOTE 1) 
FRAUDULENT SERIAL NUMBER AUXILIARY BLOCK (NOTE 1) 


nh oO 


AMPS MISCELLANEOUS AUXILIARY BLOCK 

23) 22) 21 18, 17; 16) 15) 14 10;9;,8),7,6 
WRDN 

LOCREQ 

OVRLTI 


ol 
> 
w 
Le) 
= 


=e 
+ 
— 
— 
[4 S 
4 


WORD O 


ni — 


TEVST 


SDT 
DCT GMPCF 
CPCT MPCT 


GCPCF 
SLPV 
FGDIFF 


PAGING CELL SITES AUXILIARY BLOCK 


ba 


2) 
~ 


23) 22 18,17; 16), 15 


WORD -1 
0 
1 PCELL3 
2 PCELL6 


ul 


NO. BYTES 
PCELL1 


f] 


PCELL2 
PCELLS 


PCELL4 






NO. CELLS PCELL n 


* NWAC { RCF ¢ DIX § SRN @CPA ** LPB Tt RSV 


NOTE: 
1. FOR DETAILS OF THE ROAMER SERVICE LIST AND FRAUDULENT SERIAL 
NUMBER AUXILIARY BLOCK, REFER TO REFERENCE (13) IN PARTH 18. 


Fig. 17— AMPS Miscellaneous Information Translator (Sheet 1 of 2) 
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LEGEND: 
CMAX 


CPA 
CPCT 
DCT 
DTX 
FGDIFF 
GCPCF 
GMPCF 
LOCREQ 
LPB 
MPCT 
N-1 
NEWACC 
NO. BYTES 
NO. CELLS 
NWAC 
OVRLTI 
PCELL 
RCF 
RSV 
SDT 
SID 
SLPV 
SRN 
TEVFT 
TEVST 
WRDN 
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MAXIMUM NUMBER OF ACCESS CHANNELS 

THE MOBILE HAS TO SCAN 

COMBINED PAGING AND ACCESS 

CELLSITE PROCESS COUNTER THRESHOLD 
DIVERSITY COUNTER THRESHOLD 
DISCONTINUOUS TRANSMISSION 

FRAME GAIN DIFFERENTIAL 

GLOBAL CELL SITE POWER CONTROL FLAG 
GLOBAL MODIBLE POWER CONTROL FLAG 
LOCATION REQUEST LIMIT 

LONG PAGE BUNDLING 

MOBILE PROCESS COUNTER THRESHOLD 
NUMBER OF PAGING CHANNELS THE MOBILE HAS TO SCAN 
NEW ACCESS CHANNEL 

NUMBER OF BYTES (8 BITS) 

NUMBER OF CELLS 

NEW ACCESS CHANNEL 

VOICE RADIO LOCATION TIME INTERVAL DURING OVERLOAD 
PAGING CELL SITES 

READ CONTROL FILLER WORD 

ROAMER SERVICE VALIDATION 

SAT DETECT THRESHOLD 

SYSTEM IDENTIFICATION NUMBER 

SKIP LOCATE PERIOD VALUE 

SEND SERIAL NUMBER 

TRAFFIC EVENT FAILURE THRESHOLD 
TRAFFIC EVENT SUCCESS THRESHOLD 

NUMBER OF WORDS IN THE AUXILIARY BLOCK 


Fig. 17—-AMPS Miscellaneous Information Translator (Sheet 2 of 2) 
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I/O FRAME 


FANOUT | TONP | FANOUT 


LINE 
INTERFACE 
UNIT 
(LIU) 


PERIPHERAL 
CONTROLLER 
(PC) 


ro TTY LINKS DATA LINKS TTY LINKS DATA LINKS 
(AUTOPLEX ( AUTOPLEX 
SYSTEM 100) SYSTEM 100) 
NOTE: 
1. FOUR I/O FRAMES PER I/0 GROUP 
LEGEND: 


IOMP - INPUT/OQUTPUT MICROPROCESSOR 
IOQUC - INPUT/OUTPUT UNIT CONTROLLER 
IOUS - INPUT/OUTPUT UNIT SELECTOR 


Fig. 19—1/O Member Configuration (Note 1) 
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5 3) 2 1 0 
[rosie [ror [Tous 











SUBTRANSLATOR 


. 7 a AUXILIARY BLOCK ADDRESS 


AUXILIARY BLOCK 
23) 221211] 20) 19] 18] 17] 16] 15}14]13]12)/11)10) 9; 8; 7] 6] 5] 4) 3] 2] 14 0 


LDI IOUS TYPE} IOUS 


(T) 


WORD-1 


= 
uv 
— 


PPADR 


if 


SCNPT 
PUBSCNPT 
MDPNT 
PUBMDPNT 


IOFSTMP 


CPADR 


10C7 tocs | 10c4 I0CO 


I0C15| 10014] 10013} 10C12) 10C11} 10C10; Ioc9g 


+ 
Le 
(=) 
Q 
fee) 


GRID LINE FRAME 


oo ON DN fF WO DY | CO 


_ 


_ 
—_ 







—_ 
nm 


ALL ZEROED 





peor Tanrvre | cwcsro [wee | vei [noo [osre[osrs[osto] wre [pri [P70 |) |e 


oO 
” 
4 
~< 
ao] 
m 


43 UP TO 8 CHANNELS 


* PTSOURCE ft CNTRLPT 


Fig. 20—1/O Processor Member Number Translator (Sheet 1 of 2) 
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LEGEND: 
ABO-AB2 
ACU 
AP 
CHNLSPD 
CNTRLPT 
CPADR 
DSO-DS2 
DSTYPE 
FDX 
IOCTYPE 
Toco-10C15 
ITOGRP 
IOF 
IOUS 
IOUSTYPE 
LDI 
MDPNT 
MPO-MP 1 
NMEMN 
PPADR 
PTSOURCE 
PTO-PT2 
PUBMDPNT 
PUBSCNPT 
Sc 
SCNPT 


WRON 
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INDICATES WHETHER PORT 0-2, RESPECTIVELY, IS EQUIPPED WITH ANSWER BACK (HANDSHAKING )=0 
INDICATES WHETHER AN AUTOMATIC CALL UNIT IS CONNECTED TO THE CHANNEL=0O 

INDICATES WHETHER AN APPLICATION IS CONTROLLING THE LINK=1 

CHANNEL SPEED OF THE CHANNEL 

INDICATES WHETHER THE CONTROL PULSE POINT IN A CC-GCP POINT OR ANOTHER TYPE OF POINT=O OR 1 
CONTROL PULSE POINT OCTAL ADDRESS 

DATA SET INDICATOR FOR PORT 0-2, RESPECTIVELY 

TYPE OF DATA SET ON THE CHANNEL 

INDICATES WHETHER THE CHANNEL IS HALF OR FULL DUPLEX=1 

TYPE OF I/O CONTROLLER ON THE CHANNEL=7 

EQUIPPAGE FIELDS FOR I/0 UNIT CONTROLLERS 0-15, RESPECTIVELY 

I/O GROUP 

I/O FRAME 

I/O UNIT SELECTORS 

TYPE OF IOUS CURRENTLY BEING USED=001 

HARDWARE LDI NUMBER 

UNIPOLAR CPD POINT ADDRESS OF THE FIRST OF EIGHT SIGNAL DISTRIBUTOR POINTS NEEDED PER I/0 FRAME 
EQUIPPAGE STATUS OF MICROPROCESSOR 1 OR 2, RESPECTIVELY 

OTHER I/O MEMBER NUMBER IN THE I/O FRAME 

PULSE POINT ADDRESS 

INDICATES THE FORMAT OF THE IOUS PULSE POINT SOURCE=1 

EQUIPPAGE OF PORT O-2, RESPECTIVELY 

ADDRESS OF THE SET OF SCAN POINTS FOR THE PUB TO THE I/O FRAME 

ADDRESS FOR THE SET OF SCAN POINTS OF THE PUB SERVING THIS FRAME 

TYPE OF TRANSMISSION ON THE CHANNEL =0 

SUPERVISORY MASTER SCANNER OCTAL SCAN POINT ADDRESS OF THE POWER CONTROL SWITCH 
ASSIGNED TO EACH IOUS. 

NUMBER OF WORDS IN AUXILIARY BLOCK 


Fig. 20—I/O Processor Member Number Translator (Sheet 2 of 2) 
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2 2 
7 6] 5 


2 2 
4); 3 2/1 O 
IOUS | IPUB } IOUS | IPUB 
B 1 A 0 
(a) ITEMS SCNPT AND PUBSCNPT SPECIFY THE SCAN POINT 
ADDRESS OF THE POWER CONTROL SWITCH ASSIGNED TO 
EACH IOUS AND THE SCAN POINT ADDRESS OF THE 
PUB (PERIPHERAL UNIT BUS) SERVING THIS FRAME, 


RESPECTIVELY. THE SCNPT AND PUBSCNPT LEAD 
DESIGNATIONS ARE AS FOLLOWS: 





POINT LEAD DESIGNATIONS 
sco OSCBP (POSITIVE LEAD) 
OSCBN (NEGATIVE LEAD) 
sC1 OSCAP 
OSCAN 
SC2 ASCBP 
ASCBN 
SC3 ASCAP 
ASCAN 
Sc4 1SCBP 
1SCBN 
SC5 1SCAP 
1SCAN - 
SC6 BSCAP 
BSCBN 
SC7 BSCAP 
BSCAN 


Fig. 21—1/O Processor Frame Scan Point Assignment and Lead Designations (Sheet 
1 of 3) 
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(b) ITEMS MDPNT AND PUBMDPNT SPECIFY THE BIPOLAR 
CPD (CENTRAL PULSE DISTRIBUTOR) POINT ADDRESS 
OF THE SIGNAL DISTRIBUTOR POINTS NEEDED PER 
IOUS AND THE SET OF BIPOLAR POINTS FOR THE 
PUB TO I/O FRAME, RESPECTIVELY. THE MDPNT AND 
PUBMDPNT LEAD DESIGNATIONS ARE AS FOLLOWS: 


POINT LEAD DESIGNATIONS 
MDO ocosP 
OCOSN 
MD 1 OCACKP 
OCACKN 
MD2 ACOSP 
ACOSN 
MD3 ACACKP 
ACACKN 
MD4 1COSP 
1COSN 
MDS 1CACKP 
1CACKN 
MD6 BCOSP 
BCOSN 
ne MD7 BCACKP 
BCACKN 


Fig. 21—1/O Processor Frame Scan Point Assignment and Lead Designations (Sheet 
2 of 3) 
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(c) ITEM CPADR SPECIFIES A UNIPOLAR CPD POINT. THE 
CPD POINTS ARE ASSIGNED IN CONSECUTIVE ORDER 
FOR THE ENTIRE GROUP OF I/O PROCESSORS (8-63). 
THE LEAD DESIGNATIONS ARE AS FOLLOWS: 


FOR AN EVEN NUMBERED CPD 


CPD POINT LEAD DESIGNATIONS 
Saale kde [ ee N OGCP1N1 
ae XXXX P OGCP1P1 
sh eee [ een N OGCP1N1A 
ee XXXX P OGCP1P1A 

FOR AN ODD NUMBERED CPD 

CPD POINT LEAD DESIGNATIONS 
Se econ [ cea N 1GCP1N1 
ee XXXX P 1GCP 1P1 
tl eee G& N {GCP 1N1A 
en XXXX P 1GCP1P1A 


XXXX IS THE 4-DIGIT NUMBER REPRESENTING CPD POINTS 
IN THE CPD ASSIGNMENT TABLES, REPRESENTING (FROM 
LEFT TO RIGHT) HALF, GROUP, ROW, AND COLUMN. 


Fig. 21—1/O Processor Frame Scan Point Assignment and Lead Designations (Sheet 
3 of 3) 


23,22 21/20 
MEMN = EVEN NUMBERED 





MEMBER NUMBER 


LEGEND: 
MEMN - MEMBER NUMBER 
NTPI - NONTRUNK PROGRAM INDEX 
UTYN - UNIT TYPE NUMBER 


Fig. 22—-Master Scanner Number and Central Pulse Distributor Subtranslator Word 
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HEAD TABLE 
0 





WORD O 
1 
(TYPE 1) 2 
(TYPE 2) 2 
(TYPE 3) 2 
(TYPE 4) 2 
(TYPE 5) 2 
(TYPE 1) 3 
(TYPE 2) 3 
— (TYPE 3) 3 
(TYPE 4) 3 
WORD 2 TYPE 1 - 7 DIGIT DN WORD 3 TYPE 1 - 10XXX+7 DIGIT DN 
TYPE 2 - 1+7 DIGIT DN TYPE 2 - 10XXX+17 DIGIT DN 
TYPE 3 - 10 DIGIT ON TYPE 3 - 10XXX+10 DIGIT DN 
TYPE 4 - 1+10 DIGIT DN TYPE 4 - 10XXX+1++10 DIGIT DN 
TYPE 5 - 10XXX+ (MUST HAVE WORD 3 (ZEROS ARE STORED AS ZEROS) 


WITH THIS TYPE) 


LEGEND: 
CSN - CELL SITE NUMBER 
CSN - END OF NUMBER INDICATOR 
WRDN - NUMBER OF WORDS IN AUXILIARY BLOCK 
é HRDNO - LENGTH OF HEAD TABLE 


Fig. 23—Cell Dialup Channel Translator 
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HEAD TABLE 





D Lo AUXILIARY BLOCK ADDRESS 


255 
AUXILIARY BLOCK 
23,22 18,17 16,15 12,;11,;10;9 8,7 6,5 4;,3;,2;, 1,0 
MAXBUSY- MAXBUSY - 
WORD O 
MAXSZTR- a 
GENTYPE GENRELS GENISS —_—“n 
* EMIN f WFOM {¢ LOCFCS 
LEGEND: 


CMAC - CONTROL MOBILE ATTENUATION CODE 
DCC - DIGITAL COLOR CODE 
EMIN - EXTENDED MOBILE IDENTIFICATION NUMBER 
GENISS - GENERIC ISSUE 
GENRELS - GENERIC RELEASE NUMBER 
GENTYPE - GENERIC TYPE 
LOCFCS - LOCATION EQUIPPED FACES 
MAXBUSY-OTHER - SAME AS MAXBUSY-PGR, EXCEPT THAT THE MOBILE IS ATTEMPTING TO ACCESS 
THE SYSTEM FOR ANOTHER REASON BESIDES PAGE RESPONSE 
MAXSZTR-OTHER - SAME AS MAXSZTR-PGR, EXCEPT THAT THE MOBILE IS ATTEMPTING TO SEIZE 
A CHANNEL WITH ANOTHER TYPE OF MESSAGE BESIDE A PAGE RESPONSE 
MAXBUSY-PGR - NUMBER OF TIMES A MOBILE IS ALLOWED TO FIND A SETUP CHANNEL 
BUSY BEFORE GIVING UP WITH ITS PAGE RESPONSE MESSAGE 
MAXSZTR-PGR - NUMBER OF TIMES A MOBILE IS ALLOWED TO TRY TO SEIZE A SETUP CHANNEL 
BEFORE GIVING UP WITH ITS PAGE RESPONSE 
SCC - SAT COLOR CODE 
UPN - UPDATE NUMBER 
WFOM - WAIT FOR OVERHEAD MESSAGE 
WRDN - NUMBER OF WORDS IN THE AUXILIARY BLOCK 


Fig. 24—-Cell Master Status Translator 
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MOBILE MOBILE-STATION POWER 
ATTENUATION CLASS 





Fig. 25—Interpretation of Mobile Attenuation Codes and Mobile Station Power 
Class 
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HEAD TABLE 





WORD O 


QG2-CSN : Pod AUXILIARY BLOCK ADDRESS 


255 HEAD TABLE FIXED AT 256 WORDS 


AUXILIARY BLOCK 
23; 22) 21) 20) 19) 18; 17) 16) 15) 14,13 12) 11;10); 9,8); 7;6;,5) 4,3 


UBCHRT AAFT 


(an) 


WORD -1 


oO 


ab 


RSSIBD 
AAST 
SIL 


ti} 


VRLTI 


[ sut | suo 
AL | MI | RG1 | Roo | RF | SUCHNL3 


fod 
i?) 
— 
ro 
oO 
So 

Pe") 

nN 


=Ccl cet 
ono 0onononn © & WO ND 


— 
> 


BOGRD BOGLC 


_ 
on 


_ 
op) 


— 
~ 


TODRD 
AUXILIARY BLOCK ADDRESS 
AN BE UP TO 12 AUXILIARY BLOCKS 


C | 
a1 SHEET 
2 


30 ae AUXILIARY BLOCK ADDRESS 


_ = 
o a 








N UP TO 4 PHYSICAL ANTENNA FACES 


Fig. 26—Cell Master Equipage Translator (Sheet 1 of 2) 
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Scotty's Spectrum Analyzer — Analog-to-—Digital Converter 


Overview 


This is my version of the analog—to-—digital converter for Scotty Sprowls' Modularized Spectrum 
Analyzer (MSA) project. The original analog—to—digital converter design is SLIM—ADC-16. 


The spectrum analyzer's Analog—to—Digital Converter (ADC) stage is based around (two) 16-bit 
Analog Devices AD7685 serial ADCs There is no need for any external (manual) reference 
adjustment to set the ADC conversion range and it'll still obtain excellent resolution in the MSA/VNA 
systems. Each ADC will digitize its input of 0 to 5 volts into a binary serial stream equal to 0 to 
65,535. This equates to approximately 76.3 uV per bit resolution. Only one AD7685 will be used in 
this spectrum analyzer design. The second AD7/685 for the VNA phase detector will be constructed 
and discussed in a future article. 


The "MAGVOLTS" magnitude output from the logarithmic detector is connected to the ADC's 

input. This voltage range should be from +0.4 volts to +2.4 volts (over the AD8306's 100 dB 

range). The AD/685 will then convert +0.4 volts to a bit value of 5,243. The +2.4 volts will convert 
to a bit value of 31,457. The overall dynamic bit range is equal to 26,214 bits (81,457 — 

5,243). Therefore, the conversion factor for the MSA's combination of logarithmic detector and 
16-bit ADC is: 100 dB / 26,214 bits = 0.0038 dB per bit resolution. This is what determines the final 
displayed RF power magnitude on the spectrum analyzer. 


Both ADCs will capture and clock—out their data simultaineously. The MSA software commands 
both ADCs to begin conversion with a single toggle of the CONVERT line. 16 toggles of the 
SERCLOCK line causes the AD7685 to output a serial stream of 16 bits. The Serial Data Output 
(SDO) of the AD7685 (pin 7) has a limited current (500 WA) capability. Therefore, a 2N2222 
transistor provides buffering and current sinking to drive the WAIT and ACK lines on the controlling 
computer's parallel port (LPT). The computer's LPT port is normally a TTL—compatible input with an 
internal pull—up resistor to +5V. Having two pull—up resistors shouldn't hurt and should help make 
the circuit compatible with different computers. You may have to experiment with different BIOS 
settings for your computer's parallel port if you encounter problems. 


To control the AD7685, two main control lines are used: CONVERT and SERCLOCK. Both AD/7685 
chips are controlled simultaneously. Before conversion, these lines are held low. To begin 
conversion, the CONVERT line is commanded high. This initiates the AD/685's in—chip 
sample—and-hold circuit. While CONVERT is high, any voltage changes on the analog input(s) will 
be disregarded. Also, the SDO output will be high impedance (WAIT and ACK will be high 
impedance). 


It takes approximately 2 uS for the 16-bit conversion (Sample) to take place. When complete, the 
16-bit data word will be stored in the AD/7685's buffer (hold). After conversion is complete, the 
CONVERT signal is brought low. The Most Significant Bit (MSB) D15 will be present on the SDO pin 
(there is a logic inversion by the 2N2222 on the line back to the computer, WAIT or ACK). Each time 
the SERCLOCK Is brought low, the data word is shifted by one bit. 


The data is valid 15 nanoseconds after the negative edge of SERCLOCK. It takes sixteen 


SERCLOCKs to shift out the 16—bit data word. If no data is clocked out of the buffer, the next 
CONVERT signal will overwrite the buffer. 
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MSA Software 
The MSA software works in this way: 
1.) It begins with CONVERT and SERCLOCK lines held low. 
2.) CONVERT to high. This initiates the A-to—D conversion process. 


3.) CONVERT to low. High—to—low takes about 5 US, allowing the minimum 2 US 
conversion time requirement. 


4.) SERCLOCK to high. D15 MSB is valid on SDO, and is read by the computer. 
5.) SERCLOCK to low. Next data word bit is shifted. 

6.) SERCLOCK to high. D14 bit is valid on SDO, and is read by the computer. 
7.) SERCLOCK to low. Next data word bit is shifted. 

8.) SERCLOCK to high. D183 bit is valid on SDO, and is read by the computer. 
9.) SERCLOCK to low. Next data word bit is shifted. 

10.) SERCLOCK to high. D12 bit is valid on SDO, and is read by the computer. 
11.) SERCLOCK to low. Next data word bit is shifted. 

12.) SERCLOCK to high. D11 bit is valid on SDO, and Is read by the computer. 
13.) SERCLOCK to low. Next data word bit is shifted. 

14.) SERCLOCK to high. D10 bit is valid on SDO, and is read by the computer. 
15.) SERCLOCK to low. Next data word bit is shifted. 

16.) SERCLOCK to high. D9 bit is valid on SDO, and is read by the computer. 
17.) SERCLOCK to low. Next data word bit is shifted. 

18.) SERCLOCK to high. D8 bit is valid on SDO, and Is read by the computer. 
19.) SERCLOCK to low. Next data word bit is shifted. 

20.) SERCLOCK to high. D7 bit is valid on SDO, and is read by the computer. 
21.) SERCLOCK to low. Next data word bit is shifted. 

22.) SERCLOCK to high. D6 bit is valid on SDO, and is read by the computer. 
23.) SERCLOCK to low. Next data word bit is shifted. 


24.) SERCLOCK to high. D5 bit is valid on SDO, and is read by the computer. 
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25.) SERCLOCK to low. Next data word bit is shifted. 

26.) SERCLOCK to high. D4 bit is valid on SDO, and is read by the computer. 

2/.) SERCLOCK to low. Next data word bit is shifted. 

28.) SERCLOCK to high. D3 bit is valid on SDO, and is read by the computer. 

29.) SERCLOCK to low. Next data word bit is shifted. 

30.) SERCLOCK to high. D2 bit is valid on SDO, and is read by the computer. 

31.) SERCLOCK to low. Next data word bit is shifted. 

32.) SERCLOCK to high. D1 bit is valid on SDO, and is read by the computer. 

33.) SERCLOCK to low. Next data word bit is shifted. 

34.) SERCLOCK to high. DO bit is valid on SDO, and is read by the computer. 

35.) SERCLOCK to low. SDO is high impedance. 

36.) Subsequent SERCLOCKs do nothing and the conversion process repeats. 
Video Filter 
This magnitude ADC circuit is designed with an optional input video bandwidth filter based around 
an Analog Devices ADG704 4-channel multiplexer. This will allow a selection of additional 
capacitance to be placed in parallel with the AD7685's input. 
The ADG704 can be used to select four different integration times (video bandwidths) for the final 
displayed magnitude signal. The capacitor values for the video filter were chosen arbitrarily and you 


may wish to experiment with different values. 


The video filter helps to remove excessive noise before the analog—to—digital conversion process 
and is a simple way to "narrow" to the response of the spectrum analyzer. 


The MSA software video filter selections: 


vo V1 Filter Selection Video Bandwidth 
0 0 ok = LOOO pF Wide 

0 1 oe = 0.01 OF Medium 

1 0 oo = Oe We Narrow 

1 1 oo = be! ar Extra Narrow 


Scotty's software video filter controls may still be experimental at this point. 

The video bandwidth determines the spectrum analyzer's capability to discriminate between two 
different power levels. This is because a narrower video bandwidth will remove noise in the 
logarithmic detector output. This filter is used to "smooth" the final display by removing any noise 
from the signal envelope. 


(wikipedia.org/wiki/Spectrum_analyzer#Video_bandwidth) 
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Pictures & Construction Notes 





Overview of the ADG704 video filter (right) and AD7685 16-bit ADC (left). 


Both the AD7685 and the ADG704 are in 10—pin MSOP packages, so MSOP-to-—DIP converters 
were used for soldering convenience. 


Polystyrene capacitors are used in the video filter section and the large non—polarized orange 
capacitor (1 UF) Is for the "extra narrow" video filter selection. 


The 2N2222 transistor buffer is on the lower-left. 
The SOT-89 device is a Sieko S—81250SG precision 5 volt regulator. 


The "reference" voltage (pin 1) for the AD/7685 should be very well filtered and regulated for 
maximum performance and magnitude resolution. 
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Alternate view. 


The capacitors for the video filters should be low-leakage, non—microphonic, high-quality film types 
(polystyrene, Teflon, etc.). Otherwise, switching in the video filters could cause a small shift in the 
magnitude voltage. 


The selectable video bandwidths are somewhat arbitrary. The wide video bandwidth is for the 
highest sweeping speed, medium for general speed, and narrow for very slow sweeping or to get 
the most accurate magnitude/phase data. 


The ADG704 video filter is optional and if not used, a single 1000 pF capacitor should be added 
across the input (pin 3) of the AD7685. 


This corresponds to a "wide" video filter as you do want a little bit of low-pass filtering here to keep 
the noise out, but not too much. 
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Completed overview of the analog—to—digital converter with video filter. 


It's mounted inside an old 800 MHz cellular phone receive pre—amplifier case. 
The SMA jack on the left is used for the MAGVOLTS input. 
A 1000 pF feed-through capacitor (lower-left) is used for the +12 VDC power input. 


180 pF feed-through capacitors are used for the ADG704 and AD7685 control lines. These should 
be low-value capacitors to avoid distorting the control waveforms. 
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Alternate overview. 


AD7685 voltage conversions: 


The two Least Significant Bits (LSB) are somewhat noisy which yields a more realistic 14—bit 


Analog Input (Volts) 
999924 


O00 16 
. 500000 
»499924 
.000076 
.000000 


OONNN & 


Oo 


-400000 
-400000 


Digital Output (Hexadecimal - Binary) 


PREP 
8001 
8000 
TEFE 
0001 
0000 


147B 
TAEL 


1111111111111111 
L1O00000000000001 
1O000000000000000 
OLE 
OODOD00000000001 
OOD0000000000000 


OOO0L1010001111011 
0111101011100001 





resolution. Therefore, with this circuit, the magnitude resolution of the MSA is actually around 0.01 


dB. 
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Finished case overview. 


The MAGVOLTS input of this module will then be connected back to the Logarithmic Detector 
stage. Be sure to use coaxial cable for this connection. 


The CONVERT, SERCLOCK, MAGDATA, VO, and V1 lines go back to their respective latches on the 
Control Board. 


CONVERT goes to latch P3D/7. 
SERCLOCK goes to latch P3D6. 
MAGDATA goes to WAIT (DB25 pin 11). 
VO goes to latch P4D0. 


V1 goes to latch P4D1. 
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Original SLIM—ADC-16 Schematic 


16 Bit A to D Converter 
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Document: SKSLIM-ADC-16 
For 16 Bit AtoD Converter 
Part No. SLIM-ADC-16 


Schematic 


Parts List PLSLIM-ADC-16 


Scotty Sprowls 





33 





“You didn't build that!" 


How the fuck do you close a hole in the ground? LOL! Change! 
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End of Issue #114 





Editorial and Rants 





Jon Gibson of Lake Lincolndale, New York posted a sign in his yard protesting the anti-Second 
Amendment "NY SAFE Act." 


After someone stole four of his signs, he decided to put up a motion—activated trail camera... 
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Well, well, well... It's the Somers, New York Police Department in action. 


Change! 
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U.S. Marine Corps 


War Memorial 





The U.S. Marine Corps War Memorial in Washington D.C. closed because of Obongo and the 
Democrats failure to make a budget which doesn't bankrupt the entire country. 


These memorials cost very little to run, and a troop of Boy/Girl Scouts could (should) manage them 
while the federal government "shuts down." 
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Uh-oh! 


Looks like someone knocked over the barricades and are now illegally trespassing on federal 
government property! 


Don't let Obama know or he'll send a Predator drone after you! 
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Don't worry, it was just the Syracuse Honor Flight showing Obama what they think of his "change." 


AND THEN! SAID.._. 
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The "shutdown" World War 2 memorial in Washington D.C. has better security than our borders! 
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Remember when Americans could park their own cars without the government's help? 
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